Fortinet

Fortinet disclosed CVE-2026-104286, a CVSS 9.8 path traversal and NULL byte vulnerability in FortiMail management interface allowing unauthenticated attackers to write arbitrary files and execute code. Versions 7.2.0 through 8.0.1 are affected; fixed builds are not yet available. Attackers are actively exploiting it as a zero-day.